Privacy

Last updated 28 August 2026.

SwooLab is a hobby project run by one person. There are no accounts, no email addresses and no passwords, and your data is never sold or used for advertising. This page explains exactly what is stored, why, and how to have it removed.

The person responsible for this data is the operator of SwooLab, reachable at admin@swoolab.com.

What is collected

• An anonymous ID. When you open the game you are signed in anonymously in the background, which produces a random identifier. It is not linked to your name, email, or any account, and you never enter anything to get one.
• Your game. The decks in play, the shuffle, and every action taken are stored against that anonymous ID, so you can close the tab and pick the game up later.
• Settings, on your device only. Card size, animation speed, thinking time and similar preferences are kept in your browser's local storage and are never sent anywhere.
• Bug reports. If you use the report button, whatever you type is stored along with a replay of the game it was sent from.
• Server logs. Like any website, requests are logged: IP address, the page or endpoint requested, the time, and your browser's user agent. These are used for security, debugging, and enforcing rate limits.
• Usage analytics — not for everyone. See section 4.

Why, and on what basis

Your game data is stored because storing it is the service: without it there is nothing to return to. Server logs are kept on the basis of a legitimate interest in keeping the site working and not being abused — the AI search is expensive to run, and rate limiting is what stops one visitor consuming it all. Analytics, where it applies, is used to understand which features are worth developing.

Your data is never sold, never shared with advertisers, and never used for profiling or automated decisions about you.

Sharing a game makes it public

The share button creates a link that replays your game. Anyone who has that link can open it and see the decks and every move; that is the entire point of the feature. No share is created unless you press the button.

Analytics, and who is excluded

SwooLab uses Google Analytics to count things like games started, which thinking level people choose, and whether shared links get opened. No personal details are attached to those events.

If you are in the EEA or the UK, no analytics runs at all. Your approximate country is determined from your IP address on the server, and if it is in the EEA or the UK — or if it cannot be determined with confidence — the Google Analytics code is never loaded and nothing is written to your device. The country lookup itself happens on our own server and your IP is not sent to a third party to perform it.

Who else sees this data

• Google Cloud and Firebase host the site, the anonymous sign-in, the database and the logs.
• Google Analytics receives usage events, for visitors outside the EEA and UK only.
• Cloudflare serves images, fonts and scripts from its storage network.
• MaxMind supplies the offline database used for the country lookup described above. It is queried on our own server, so no request about you is sent to MaxMind.
• SWUDB receives a request only when you paste a deck link or code, in order to fetch that decklist.

These providers are based in, or store data in, the United States. Nobody else receives your data, and it is never sold or traded.

How long it is kept

Game records, shared replays and bug reports are kept indefinitely, so that a game you return to months later still loads and a shared link does not stop working. Server logs are kept for a shorter period, in line with the hosting platform's default retention.

Your rights, and how to use them

You can ask what is stored about you, ask for it to be corrected, or ask for it to be deleted. If you are in the EEA or the UK you also have the right to object to processing, to request a copy in a portable form, and to complain to your national data protection authority.

To make a request, use the report button in the game's top bar and write what you want there. Since sign-in is anonymous, the random ID is the only thing that connects you to your data. A request sent from inside the game carries that ID from the live session automatically.

Requests are handled by one person, so allow a little time, but they will be answered. You can also clear your browser's storage for this site at any time, which removes the link between your browser and the stored game.

Children

SwooLab is not directed at children under 13, and there is no knowing collection of data from them. If you are a parent or guardian and believe a child in your care has provided data here, contact admin@swoolab.com and it will be looked into and deleted where that turns out to be the case. Enough detail to identify the data is needed before anything is removed.

Changes

This page describes how SwooLab works today, not how it might work later. When something changes, so does this page, along with the date at the top.

For a wording fix or a clarification, that date is the whole of it. For a change that actually affects you — a new kind of data collected, a new company involved, or an existing thing used for a new purpose — a notice will go up on the site before the change takes effect, not after. Since there are no accounts, there is no mailing list to send anything to, so the site itself is the channel.

Questions about any of this: admin@swoolab.com. The FAQ covers how the site and the AI work.